Opefin Source Addendum

1. About this addendum

This addendum applies when a business’s request uses Opefin Source. You agree to it by approving that request on the request screen, which names Opefin Source and links here. It forms part of the Global Consumer Terms, the Global Privacy Policy and the Consumer Consent Disclosure Notice (the core documents). Where it differs from them on Opefin Source, this addendum applies, but nothing in it reduces your rights under consumer or privacy law.

A business may ask you for one of two reasons. It may be checking you because of your own dealings with it. Or it may be onboarding a company, trust or other entity you are connected to, as a director, owner, settlor, trustee, beneficiary or in another role, and it needs to verify the people behind that entity. Either way, the request screen names the business and says why it is asking, and nothing is shared unless you approve.

2. What Opefin is and isn’t, for Opefin Source

Anti-money laundering law, such as New Zealand’s Anti-Money Laundering and Countering Financing of Terrorism Act 2009 and Australia’s Anti-Money Laundering and Counter-Terrorism Financing Act 2006, requires many businesses to verify their customers and understand the risks of dealing with them. That law applies to the business, not to Opefin, and it doesn’t require you to use Opefin.

• We’re not a reporting entity under either Act. We don’t provide a designated service, we don’t carry out customer due diligence for any reporting entity, we’re not the agent of one, and we’re not a member of a designated business group or reporting group. The record-keeping duties in those Acts apply to the business, not to us.
• Opefin Source prepares information for the business. Its results, including the initial risk score and any suggested next steps, are information and automated signals for the business to consider. They aren’t advice, they aren’t a decision about you, and they don’t confirm that the business has met any legal requirement. The business decides whether they suit its own programme.
• The business decides. The business, or the compliance provider it uses, reviews anything unclear and makes its own decisions, including whether to deal with you. We don’t review your photos as part of a check, and we don’t decide whether a business accepts you. A small number of named staff can open them where it’s needed to run, support or secure the platform, to look into a suspected security or fraud problem, to answer a request or complaint from you, or where the law requires it. Every access is logged.

3. What Opefin Source does

When you approve a request that uses Opefin Source, it:

• prepares the business’s verification pack from your Opefin Passport: your verified details, ID image, verification result and, where your Opefin Passport holds one, your face photo, in the form the business needs;
• runs list checks against sanctions lists, lists of people in prominent public roles and their family members and close associates, and news reports about crime;
• prepares an initial risk score for the business’s own assessment, using its own risk settings and based on your verification result, the list checks and any source of funds or source of wealth analysis;
• looks at where your money came from, and where your assets came from, if the business asks (section 5);
• repeats the list checks over time, if the business switches on ongoing checks (section 6); and
• gives the business, and the compliance provider it uses, tools inside our platform to review the results, only for that business’s dealings with you. The business makes every decision.

The request screen shows which of these the business has asked for. Where the business needs them, Opefin Source also reads documents about companies and trusts, such as a trust deed, company records, financial statements, an asset register or a depreciation schedule. In Australia, where a business asks, Opefin may also obtain an extract about a company from a public register.

Suggested next steps are prompts the platform produces for the business, such as asking for a further document or reviewing a possible list match. They are suggestions to the business only. They are not decisions, and the business is free to ignore them.

4. What Opefin Source collects, and who receives it

Who receives it. The business that asked receives its verification pack: your verified details, ID image, verification result and any face photo your Opefin Passport holds, the list check results, the initial risk score, and any source of funds or source of wealth information, so it can make its own decisions and keep its own records. A provider working for it, such as a compliance or managed service provider, receives the same information inside our platform. Your approval of the request covers that provider, which acts on the business’s instructions and only for that business’s dealings with you. When a later business’s request uses Opefin Source and you approve it, that business receives what its request screen shows, usually including a fresh initial risk score and any source of funds or source of wealth information from your earlier check.

Our providers. Our identity verification provider runs the list checks in the European Union, and our AI provider helps with the analysis in the United States. Section 7 of the Consumer Consent Disclosure Notice and Part 9 of the Global Privacy Policy explain where information is held and how it’s protected.

If you give us documents that name other people, we may contact them to tell them about this addendum, or ask you to pass it on.

Where a business verified your identity itself and you agreed to an Opefin Passport, these checks run on the details read from the ID document it checked, in the same way as they would on details from a check you did online. The list check results are held in your Opefin Passport and, like anything else in it, are available to another business only where you approve that business’s request. The initial risk score and any review notes stay with the business that asked, as section 8 explains.

5. Source of funds and source of wealth

These are two different questions, and a business may ask you either or both. The request screen tells you which. Source of funds is where the money for this particular dealing came from, such as the money you are using to buy a property or to settle a matter. Source of wealth is broader: how you came to have your assets overall, such as income over a career, a business you own, an inheritance or the sale of a property. You choose how to show either: upload documents, or connect your bank. The screen for this step explains how we use what you provide before you choose.

• What we collect. The documents you upload, such as payslips, bank statements, a sale agreement or records of how you came by an asset, and, if you connect your bank, account details, balances and transactions for the accounts and period you authorise. Where the request concerns a company, trust or other entity you are connected to, the documents can also include that entity’s financial statements, asset register, depreciation schedule and company records, provided by you or by the business.
• How we use it. Automated tools, including AI, read your documents or bank information to work out where the money for this dealing came from and, where the business asks, how you came to have your assets. Where entity documents are provided, those tools read them to work out what the entity holds and where its funds and assets came from. We use what we produce only for that analysis and the verification pack, not to draw conclusions about other things, such as your health, beliefs or memberships.
• What the business receives. Your documents and our analysis. From a bank connection, what that connection’s consent allows. In Australia, that’s only the forms the Consumer Data Right rules allow, such as a summary.
• Keeping it, and later requests. We keep your documents and our analysis with your Opefin Passport. A later business receives them only if you approve its request, or the law requires it. Bank information needs a separate approval each time.
• Other people’s details. Documents can include details of other people, such as the other party to a sale or someone who gave you money. We use them only for this analysis and the verification pack.
• Bank connections. A bank connection is a separate consent with the open banking provider, which you can manage or end. In Australia it runs under the Consumer Data Right, as Part AU 5 of the Global Privacy Policy explains. Ending it doesn’t undo analysis already done or information already shared.
• If you’d rather not. The business may accept other ways to show where your money came from, such as paper records. Ask the business.

6. Ongoing checks

If the business switches on ongoing checks, we repeat the list checks while they stay on and give the business the results. The request screen tells you if the business uses them. If you ask us to stop sharing, we stop the ongoing checks, and the business may then need to check you in other ways.

7. Automated results

The initial risk score and the source of funds and source of wealth analysis are produced by automated tools, including AI, using your verification result, list check results, the business’s own risk settings, and any documents and bank information you provide or authorise. Like any automated process, they can be wrong. For example, a list check can match a different person who shares your name. Any suggested next steps are for the business to consider. The business, or the compliance provider it uses, reviews the results and makes its own decisions, which can significantly affect you.

If you think a result is wrong, tell the business, or email privacy@opefin.com. We’ll investigate, correct our record, and tell any business that received the incorrect result.

8. How long we keep it

Holds, deletion and what happens when a person dies work as Part 10 of the Global Privacy Policy describes. Asking us to remove your photos doesn’t delete copies the business has already received.

9. Your choices

• Approving a request that uses Opefin Source is your choice. The business can verify you in other ways, for example by seeing your original ID in person or by accepting copies certified by a trusted referee, such as a lawyer or Justice of the Peace. These can take longer. To go this way, contact the business.
• Source of funds and source of wealth. You choose documents or a bank connection, and the business may accept other ways.
• Stopping. You can ask us to remove your photos and stop sharing at any time, as section 9 of the Consumer Consent Disclosure Notice explains. Ongoing checks then stop. Copies the business already holds stay with it, under its own obligations.

10. Sensitive information in Australia

Some information the list checks may find, such as a criminal record or membership of a political party, is sensitive information under Australian law. Documents and bank transactions can also reveal it, for example union fees or payments to a medical practice. We collect it only as part of Opefin Source, only where it’s reasonably necessary for that service, and only with your consent (APP 3.3). You give that consent by approving a request that uses Opefin Source and, for source of funds or source of wealth, by choosing to upload documents or connect your bank. You can withdraw it at any time by asking us to stop sharing.

11. What you agree to do

You agree to answer source of funds and source of wealth questions truthfully, without hiding or misrepresenting anything, and to provide only documents and bank accounts you’re entitled to share. Part 6 of the Global Consumer Terms also applies.

12. Our responsibility

• Opefin Source results, including the initial risk score and any suggested next steps, are prepared for the business’s convenience. They’re information and automated signals, not advice, not a decision about you, and not confirmation that any legal requirement is met.
• Information from lists, news sources, banks and other third parties is passed on as we receive it. We take reasonable care, and we correct our record when we learn of an error, but we can’t guarantee that information held by others is accurate.
• To the extent the law allows, we’re not responsible for a business’s decisions based on Opefin Source, including whether to deal with you, or for how it meets its anti-money laundering obligations.
• Part 12 of the Global Consumer Terms applies to Opefin Source, including the limit on our liability. Nothing in this addendum limits the rights in 12.1 of those terms.

13. Changes and contact

We may change this addendum in the way Part 15 of the Global Consumer Terms and Part 17 of the Global Privacy Policy describe. The current version is at opefin.com/legal/opefin-source-addendum.

Contact and full terms